+
    ˜qgjØ+  ã            
       óò  a € R  t-0 t R t^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHtH	t	H
t
 ^ RIHtHtHtHt ^ RIHt ^ RIHt ^ RIHt ^ RIHtHt ^ RIHt R	R
R].R]R. /t] ^ k ]P8                  ! ]4      t. R!OtR.t Rt!Rt". t#] ^k / t$/ t%] FO  t&]$PO                  ]& R2]!]&,          R3]& R2]!]&,           R2R3]& R2]!]&,           R2R3/4       ]& R2]%]& R2&   KQ  	  Rt(R R lt)R R lt*R t+R"R R llt,R# )#zSSH: Configure SSH and SSH keysN)ÚListÚOptionalÚSequence)Ú	lifecycleÚssh_utilÚsubpÚutil)ÚCloud)ÚConfig)Ú
MetaSchema)ÚALL_DISTROSÚug_util)ÚPER_INSTANCEÚidÚcc_sshÚdistrosÚ	frequencyÚactivate_by_schema_keysÚed25519z/etc/ssh/ssh_host_%s_keyTÚ_privateé€  Ú_publicú.pubé¤  Ú_certificatez	-cert.pubz;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s"c                ó(   € V ^8„  d   QhR\         RR/# )é   ÚkeyfileÚreturnN)Ústr)Úformats   "Ú9/usr/lib/python3/dist-packages/cloudinit/config/cc_ssh.pyÚ__annotate__r"   =   s   € ÷ !3ñ !3¤cð !3¨dñ !3ó    c                óP  € Rp\         P                  ! 4       pV'       d    V\        P                  ! ^	^ 4      8  d   RpMRp\        P
                  ! R4      pVR8w  d   \        P                  ! V RV4       \        P                  ! W4       \        P                  ! V  R2V4       R# )a¬  
For fedora 37, centos 9 stream and below:
 - sshd version is earlier than version 9.
 - 'ssh_keys' group is present and owns the private keys.
 - private keys have permission 0o640.
For fedora 38, centos 10 stream and above:
 - ssh version is at least version 9.
 - 'ssh_keys' group is absent. 'root' group owns the keys.
 - private keys have permission 0o600, same as upstream.
Public keys in all cases have permission 0o644.
r   i   r   Ússh_keysr   Néÿÿÿÿ)	r   Úget_opensshd_upstream_versionr   ÚVersionr   Úget_group_idÚosÚchownÚchmod)r   Úpermissions_publicÚssh_versionÚpermissions_privateÚgids   &    r!   Úset_redhat_keyfile_permsr1   =   sŠ   € ð ÐÜ×8Ò8Ó:€Kß�{¤Y×%6Ò%6°q¸!Ó%<Ô<ð
 $Ñð $Ðä
×
Ò
˜JÓ
'€CØ
ˆb„yô
 	�Š�˜"˜cÔ"Ü‡H‚HˆWÔ*Ü‡H‚H�ˆy˜ÐÐ1Ö2r#   c          
      óL   € V ^8„  d   QhR\         R\        R\        R\        RR/# )r   ÚnameÚcfgÚcloudÚargsr   N)r   r
   r	   Úlist)r    s   "r!   r"   r"   a   s6   € ÷ ]=ñ ]=”ð ]=œ6ð ]=¬%ð ]=´tð ]=Àñ ]=r#   c           
      óf  € VP                  R R4      '       dU   \        P                  P                  RR4      p\        P                  ! V4       F  p \
        P                  ! V4       K  	  RV9   Edµ   . pVR,          P                  4        F®  w  rxV\        9  d;   \        P                  ! RV4      '       d   Rp	MRp	\        P                  R	W—4       KJ  \        V,          ^ ,          p
\        V,          ^,          p\
        P                  ! W¨V4       R
V9   g   K’  VP!                  R\#        V
4      34       K°  	  V'       d   \$        P&                  ! V4       \(        P                  4        F±  w  rÍWÑR,          9   g   WÁR,          9  d   K!  \        V,          ^ ,          \        V,          ^ ,          rþRR\*        Wï3,          .p \
        P,                  ! RRR7      ;_uu_ 4        \.        P.                  ! VRR7       RRR4       \        P1                  RWþ4       K³  	  EMÙ\
        P2                  ! VR\4        4      p\
        P6                  ! 4       '       g   TMV Uu. uF  pV\8        9  g   K  VNK  	  upp\;        V4      P=                  V4      pV'       d&   \        P1                  RRP                  V4      4       V EF3  p\>        V,          p\        P                  PA                  V4      '       d   K8  \
        PB                  ! \        P                  PE                  V4      4       RRVRRRV.p\
        P,                  ! RRR7      ;_uu_ 4         \.        P.                  ! VRRR/R 7      w  pp\
        PF                  ! VR!R4      '       g4   \H        PJ                  PM                  \
        PN                  ! V4      4       VPP                  PR                  R"8X  d   \U        V4       RRR4       EK6  	  R&V9   dH   \
        P2                  ! VR&,          R'\`        4      p\
        PF                  ! VR&,          R(\b        4      pM\`        p\b        pV'       d)   \e        VR)7      p VPf                  Pi                  V4        \j        Pl                  ! WPP                  4      w  pp\j        Pn                  ! V4      w  pp \
        PF                  ! VR+R4      p!\
        Pp                  ! VR,\$        Pr                  4      p". p#\
        PF                  ! VR-R4      '       d   VPu                  4       ;'       g    . p#M\        P1                  R.4       R/V9   d   VR/,          p$V#Pw                  V$4       \y        V#VV!V"4       R#   \         d"    \
        P                  ! \        RT4        EKd  i ; i  + '       g   i     EL»; i  \         d'    \
        P                  ! \        RT RT 24        EK‰  i ; iu upi   \.        PV                   d©   p\
        PN                  ! TPX                  4      P[                  4       pTP\                  ^8X  dB   TP[                  4       P_                  R#4      '       d   \        P1                  R$T4        Rp?EL¤\
        P                  ! \        R%TT4        Rp?ELÇRp?ii ; i  + '       g   i     EK  ; i  \         d     \
        P                  ! \        R*4        ELvi ; i  \         d     \
        P                  ! \        R04        R# i ; i)1Ússh_deletekeysTz	/etc/ssh/zssh_host_*key*zFailed deleting key file %sr%   z4^(ecdsa-sk|ed25519-sk)_(private|public|certificate)$ÚunsupportedÚunrecognizedz Skipping %s ssh_keys entry: "%s"r   ÚHostCertificateÚshz-xcz/etc/ssh)Ú	recursiveF)ÚcaptureNzGenerated a key for %s from %szFailed generating a key for z from Ússh_genkeytypesz5skipping keys that are not supported in fips mode: %sÚ,z
ssh-keygenz-tz-NÚ z-fÚLANGÚC)r?   Ú
update_envÚssh_quiet_keygenÚredhatzunknown keyz!ssh-keygen: unknown key type '%s'z(Failed generating key type %s to file %sÚssh_publish_hostkeysÚ	blacklistÚenabled)rI   zPublishing host keys failed!Údisable_rootÚdisable_root_optsÚallow_public_ssh_keyszSSkipping import of publish SSH keys per config setting: allow_public_ssh_keys=FalseÚssh_authorized_keysz Applying SSH credentials failed!)=Úgetr*   ÚpathÚjoinÚglobr   Údel_fileÚ	ExceptionÚlogexcÚLOGÚitemsÚCONFIG_KEY_TO_FILEÚreÚmatchÚwarningÚ
write_fileÚappendr   r   Úappend_ssh_configÚPRIV_TO_PUBÚKEY_GEN_TPLÚSeLinuxGuardr   ÚdebugÚget_cfg_option_listÚGENERATE_KEY_NAMESÚfips_enabledÚFIPS_UNSUPPORTED_KEY_NAMESÚsetÚ
differenceÚKEY_FILE_TPLÚexistsÚ
ensure_dirÚdirnameÚget_cfg_option_boolÚsysÚstdoutÚwriteÚdecode_binaryÚdistroÚosfamilyr1   ÚProcessExecutionErrorÚstderrÚlowerÚ	exit_codeÚ
startswithÚHOST_KEY_PUBLISH_BLACKLISTÚPUBLISH_HOST_KEYSÚget_public_host_keysÚ
datasourceÚpublish_host_keysr   Únormalize_users_groupsÚextract_defaultÚget_cfg_option_strÚDISABLE_USER_OPTSÚget_public_ssh_keysÚextendÚapply_credentials)%r3   r4   r5   r6   Úkey_pthÚfÚcert_configÚkeyÚvalÚreasonÚtgt_fnÚ	tgt_permsÚprivate_typeÚpublic_typeÚprivate_fileÚpublic_fileÚcmdÚgenkeysÚnamesÚ	key_namesÚskipped_keysÚkeytyper   ÚoutÚerrÚeÚhost_key_blacklistÚpublish_hostkeysÚhostkeysÚusersÚ_groupsÚuserÚ_user_configrK   rL   ÚkeysÚcfgkeyss%   &&&&                                 r!   Úhandler£   a   sØ  € ð ‡w�wÐ ×&Ò&Ü—'‘'—,‘,˜{Ð,<Ó=ˆÜ—’˜7Ö#ˆAðCÜ—’˜aÖ ñ $ð �SÕàˆØ˜J�×-Ñ-Ö/‰HˆCØÔ,Ô,Ü—8’8ØJÈC÷ò ð +‘Fà+�FÜ—‘Ð>ÀÔLÙÜ'¨Õ,¨QÕ/ˆFÜ*¨3Õ/°Õ2ˆIÜ�OŠO˜F¨Ô3à Ö$Ø×"Ñ"Ð$5´s¸6³{Ð#CÖDñ 0÷" Ü×&Ò& {Ô3ä)4×):Ñ):Ö)<Ñ%ˆLà :�Ô.Ø¨:¥Ô6áä" <Õ0°Õ3Ü" ;Õ/°Õ2ð &ð ˜¤¨|Ð.IÕ IÐJˆCðä×&Ò& z¸T×BÖBÜ—I’I˜c¨5Õ1÷ Cä—	‘	Ø4°köó *=ô4 ×*Ò*ØÐ"Ô$6ó
ˆô ×$Ò$×&Ò&ñ ñ %óá$�EØÔ :Ñ:÷ �Ù$ñð 	ô ˜7“|×.Ñ.¨yÓ9ˆßÜ�I‰IØGØ—‘˜Ó&ôô
 !ˆGÜ" gÕ.ˆGÜ�w‰w�~‰~˜g×&Ò&ÙÜ�OŠOœBŸG™GŸO™O¨GÓ4Ô5Ø  w°°b¸$ÀÐHˆCô ×"Ò" :¸×>Ö>ðÜ#ŸyšyØ T°v¸s°mô ‘H�C˜ô  ×3Ò3ØÐ/°÷ò ô Ÿ
™
×(Ñ(¬×);Ò);¸CÓ)@ÔAà—|‘|×,Ñ,°Ô8Ü0°Ô9÷ ?Ò>ñ !ðD  Ô$Ü!×5Ò5ØÐ&Õ'ØÜ&ó
Ðô
  ×3Ò3ØÐ&Õ'¨Ô4Eó
Ñô 8ÐÜ,ÐçÜ'Ð2DÔEˆð	=Ø×Ñ×.Ñ.¨xÔ8ð=Ü"×9Ò9¸#¿|¹|ÓLÑˆ�Ü&×6Ò6°uÓ=Ñˆˆ|Ü×/Ò/°°^ÀTÓJˆÜ ×3Ò3ØÐ$¤h×&@Ñ&@ó
Ðð ˆÜ×#Ò# CÐ)@À$×GÒGØ×,Ñ,Ó.×4Ð4°"‰Dä�I‰Ið>ôð
 ! CÔ'ØÐ/Õ0ˆGØ�K‰K˜Ô ä˜$  lÐ4EÖFøôg ô CÜ—’œCÐ!>À×BÐBðCú÷N C×BÐBûô
 ô Ü—’ÜØ2Ø"�m 6¨,¨ð9÷ð ðüòøôB ×1Ñ1ô Ü×,Ò,¨Q¯X©XÓ6×<Ñ<Ó>�CØ—{‘{ aÔ'¨C¯I©I«K×,BÑ,BØ%÷-ò -ô Ÿ	™	Ð"EÀw×OÒOäŸšÜØFØ#Ø#÷	ò ûðú÷ ?×>Ñ>ûôV ô 	=Ü�KŠKœÐ;×<ð	=ûô2 ô =Ü�Š”CÐ;×<ð=ús¸   ÁVÇ WÇ,V7ÈWÉ&W?É8W?Í[Í BXÑ1[ ÒB0\ Ô>A\ Ö'V4Ö3V4Ö7W×	W×,W<×;W<Ø[	ØA#Z<	Ù=Z<	Ú[ÚZ<	Ú6[Ú<[	Û[Û[Û&\Ü\Ü&\0Ü/\0c                 óü   € \        V 4      p V'       d   \        P                  ! W4       V'       d0   V'       g   R pVP                  RV4      pVP                  RR4      pMRp\        P                  ! V RVR7       R# )ÚNONEz$USERz$DISABLE_USERÚrootrB   )ÚoptionsN)rg   r   Úsetup_user_keysÚreplace)r¡   rŸ   rK   rL   Ú
key_prefixs   &&&& r!   r„   r„     sb   € äˆt‹9€DßÜ× Ò  Ô,çßØˆDØ&×.Ñ.¨w¸Ó=ˆ
Ø×'Ñ'¨¸Ó@‰
àˆ
ä×Ò˜T 6°:×>r#   c                óP   € V ^8„  d   QhR\         \        \        ,          ,          /# )r   rI   )r   r   r   )r    s   "r!   r"   r"     s   € ÷ ñ ¤H¬X´c­]Õ$;ñ r#   c                ó¶  € \         : R2p. p. pV '       d   V  Uu. uF  qAV3,          NK  	  pp\        P                  ! VR,          4       Uu. uF  pWS9  g   K  VNK  	  ppV Ff  p\        P                  ! V4      pVP	                  4       p	V	'       g   K3  \        V	4      ^8”  g   KE  VP                  \        V	R,          4      4       Kh  	  V# u upi u upi )a  Read host keys from /etc/ssh/*.pub files and return them as a list.

@param blacklist: List of key types to ignore. e.g. ['rsa']
@returns: List of keys, each formatted as a two-element tuple.
    e.g. [('ssh-rsa', 'AAAAB3Nz...'), ('ssh-ed25519', 'AAAAC3Nx...')]
r   :Nr   N)Ú*)ri   rR   r   Úload_text_fileÚsplitÚlenr]   Útuple)
rI   Úpublic_key_file_tmplÚkey_listÚblacklist_filesÚkey_typeÚhostfileÚ	file_listÚ	file_nameÚfile_contentsÚkey_datas
   &         r!   r{   r{     sÛ   € ÷ (4Ð5ÐØ€HØ€Oßñ @Ió
Ù?H°8 H ;×.Ð.¹yð 	ð 
ô Ÿ	š	Ð"6¸Õ"?Ô@óá@ˆHØÑ*÷ 	ˆÙ@ð ð ó ˆ	Ü×+Ò+¨IÓ6ˆØ ×&Ñ&Ó(ˆß‰8œ˜H›¨Ö)Ø�O‰OœE (¨2¥,Ó/Ö0ñ	 ð
 €Oùò#
ùòs   ›CÁCÁCc                ó~   € V ^8„  d   Qh/ ^ \         9   d
   \        ;R&   ^\         9   d   \        \        ,          ;R&   # )r   Úmetary   )Ú__conditional_annotations__r   r   r   )r    s   "r!   r"   r"      s6   € × %Ñ %÷*ò „jñ ñ+ &÷H +Ò *œD¤�IÑ *òI &r#   )ÚrsaÚecdsar   )N).r½   Ú__doc__rR   Úloggingr*   rY   rn   Útypingr   r   r   Ú	cloudinitr   r   r   r   Úcloudinit.cloudr	   Úcloudinit.configr
   Úcloudinit.config.schemar   Úcloudinit.distrosr   r   Úcloudinit.settingsr   r¼   Ú	getLoggerÚ__name__rV   rd   rf   ri   rz   ry   rX   r_   ÚkÚupdater`   r1   r£   r„   r{   r"   )r½   s   @r!   Ú<module>rÍ      sA  øðö &ã Û Û 	Û 	Û 
ß +Ñ +ç 5Ó 5Ý !Ý #Ý .ß 2Ý +ð 	ˆ(Ø�ˆ}Ø�Ø˜rð	€ó ð ×Ò˜Ó!€â0Ð Ø'˜[Ð à)€ØÐ à(*Ð Ó *àÐ Ø€Û	€AØ×Ñàˆc�ˆN˜\¨AÕ-¨uÐ5Øˆc�ˆM˜|¨aÕ/Ð0°Ð5°uÐ=Øˆc�Ð L°1Õ$4Ð#5°YÐ!?ÀÐ Gð	
ôð &' C w -€K�1�#�X�Óñ 
ð L€õ!3õH]=ò@?÷"ñ r#   