[pve-devel] r6435 - in pve-cluster/trunk: . data data/PVE debian
svn-commits at proxmox.com
svn-commits at proxmox.com
Tue Aug 9 08:22:18 CEST 2011
Author: dietmar
Date: 2011-08-09 08:22:17 +0200 (Tue, 09 Aug 2011)
New Revision: 6435
Modified:
pve-cluster/trunk/Makefile
pve-cluster/trunk/data/ChangeLog
pve-cluster/trunk/data/PVE/Cluster.pm
pve-cluster/trunk/data/PVE/pvecm
pve-cluster/trunk/debian/changelog
pve-cluster/trunk/debian/postinst
Log:
* also handle ssh known_hosts file
Modified: pve-cluster/trunk/Makefile
===================================================================
--- pve-cluster/trunk/Makefile 2011-08-09 04:24:26 UTC (rev 6434)
+++ pve-cluster/trunk/Makefile 2011-08-09 06:22:17 UTC (rev 6435)
@@ -2,7 +2,7 @@
PACKAGE=pve-cluster
PKGVER=1.0
-PKGREL=3
+PKGREL=4
ARCH:=$(shell dpkg-architecture -qDEB_BUILD_ARCH)
Modified: pve-cluster/trunk/data/ChangeLog
===================================================================
--- pve-cluster/trunk/data/ChangeLog 2011-08-09 04:24:26 UTC (rev 6434)
+++ pve-cluster/trunk/data/ChangeLog 2011-08-09 06:22:17 UTC (rev 6435)
@@ -1,5 +1,8 @@
2011-08-09 Proxmox Support Team <support at proxmox.com>
+ * PVE/Cluster.pm (ssh_merge_known_hosts): also manage known_hosts
+ file.
+
* PVE/pvecm (backup_database): revert pervious change - do not
pass IP to addnode. Instead we run gen_pve_node_files in 'add'
after we get quorum.
Modified: pve-cluster/trunk/data/PVE/Cluster.pm
===================================================================
--- pve-cluster/trunk/data/PVE/Cluster.pm 2011-08-09 04:24:26 UTC (rev 6434)
+++ pve-cluster/trunk/data/PVE/Cluster.pm 2011-08-09 06:22:17 UTC (rev 6435)
@@ -39,6 +39,15 @@
# and is used for CSRF prevention
my $pvewww_key_fn = "$basedir/pve-www.key";
+# ssh related files
+my $ssh_rsa_id_priv = "/root/.ssh/id_rsa";
+my $ssh_rsa_id = "/root/.ssh/id_rsa.pub";
+my $sshrootknownhosts = "/root/.ssh/known_hosts";
+my $sshknownhosts = "/etc/pve/priv/known_host";
+my $sshauthkeys = "/etc/pve/priv/authorized_keys";
+my $rootsshauthkeys = "/root/.ssh/authorized_keys";
+
+
my $observed = {
'storage.cfg' => 1,
'cluster.cfg' => 1,
@@ -298,6 +307,8 @@
$force = 1 if $opt_force;
gen_pve_ssl_cert($force, $nodename, $ip);
+
+ ssh_merge_known_hosts();
}
my $versions = {};
@@ -907,3 +918,120 @@
return undef;
}
+
+# ssh related utility functions
+
+sub ssh_merge_keys {
+ # remove duplicate keys in $sshauthkeys
+ # ssh-copy-id simply add keys, so the file can grow to large
+
+ # always add ourself
+ my $pub = PVE::Tools::file_get_contents($ssh_rsa_id);
+ chomp($pub);
+
+ my $data = PVE::Tools::file_get_contents($sshauthkeys, 128*1024);
+ chomp($data);
+
+ $data .= "\n$pub\n";
+
+ my $newdata = "";
+ my $vhash = {};
+ while ($data && $data =~ s/^((.*?)(\n|$))//) {
+ my $line = "$2\n";
+ if ($line =~ m/^ssh-rsa\s+\S+\s+(\S+)$/) {
+ $vhash->{$1} = $line;
+ } else {
+ $newdata .= $line;
+ }
+ }
+
+ $newdata .= join("", values(%$vhash));
+
+ PVE::Tools::file_set_contents($sshauthkeys, $newdata, 0600);
+}
+
+sub setup_ssh_keys {
+
+ # create ssh key if it does not exist
+ if (! -f $ssh_rsa_id) {
+ mkdir '/root/.ssh/';
+ system ("echo|ssh-keygen -t rsa -N '' -b 2048 -f ${ssh_rsa_id_priv}");
+ }
+
+ mkdir $authdir;
+
+ if (! -f $sshauthkeys) {
+ my $fh = IO::File->new ($sshauthkeys, O_CREAT|O_WRONLY|O_EXCL, 0400);
+ close($fh);
+ }
+
+ warn "can't create shared ssh key database '$sshauthkeys'\n"
+ if ! -f $sshauthkeys;
+
+ if (-f $rootsshauthkeys) {
+ system("mv '$rootsshauthkeys' '$rootsshauthkeys.org'");
+ }
+
+ if (! -l $rootsshauthkeys) {
+ symlink $sshauthkeys, $rootsshauthkeys;
+ }
+ warn "can't create symlink for ssh keys '$rootsshauthkeys' -> '$sshauthkeys'\n"
+ if ! -l $rootsshauthkeys;
+
+}
+
+sub ssh_merge_known_hosts {
+
+ return if -l $sshrootknownhosts;
+
+ mkdir $authdir;
+
+ if (! -f $sshknownhosts) {
+ if (my $fh = IO::File->new($sshknownhosts, O_CREAT|O_WRONLY|O_EXCL, 0600)) {
+ close($fh);
+ }
+ }
+
+ my $old = PVE::Tools::file_get_contents($sshknownhosts, 128*1024);
+
+ my $new = PVE::Tools::file_get_contents($sshrootknownhosts, 128*1024);
+
+ my $data = '';
+
+ my $vhash = {};
+ while ($old && $old =~ s/^((.*?)(\n|$))//) {
+ my $line = "$2\n";
+ next if $line =~ m/^\s*$/; # skip empty lines
+ next if $line =~ m/^#/; # skip comments
+ if ($line =~ m/^(\S+)\sssh-rsa\s.*$/) {
+ if (!$vhash->{$1}) {
+ $vhash->{$1} = 1;
+ $data .= $line;
+ }
+ } else {
+ $data .= $line;
+ }
+ }
+
+ while ($new && $new =~ s/^((.*?)(\n|$))//) {
+ my $line = "$2\n";
+ next if $line =~ m/^\s*$/; # skip empty lines
+ next if $line =~ m/^#/; # skip comments
+
+ if ($line =~ m/^(\S+)\sssh-rsa\s.*$/) {
+ if (!$vhash->{$1}) {
+ $vhash->{$1} = 1;
+ $data .= $line;
+ }
+ }
+ }
+
+ PVE::Tools::file_set_contents($sshknownhosts, $data);
+
+ unlink $sshrootknownhosts;
+ symlink $sshknownhosts, $sshrootknownhosts;
+
+ warn "can't create symlink for ssh known hosts '$sshrootknownhosts' -> '$sshknownhosts'\n"
+ if ! -l $sshrootknownhosts;
+
+}
Modified: pve-cluster/trunk/data/PVE/pvecm
===================================================================
--- pve-cluster/trunk/data/PVE/pvecm 2011-08-09 04:24:26 UTC (rev 6434)
+++ pve-cluster/trunk/data/PVE/pvecm 2011-08-09 06:22:17 UTC (rev 6435)
@@ -24,68 +24,13 @@
my $local_ip_address = PVE::Cluster::remote_node_ip($nodename);
my $basedir = "/etc/pve";
-my $ssh_rsa_id_priv = "/root/.ssh/id_rsa";
-my $ssh_rsa_id = "/root/.ssh/id_rsa.pub";
-my $sshauthkeys = "/etc/pve/priv/authorized_keys";
-my $rootsshauthkeys = "/root/.ssh/authorized_keys";
my $clusterconf = "$basedir/cluster.conf";
my $libdir = "/var/lib/pve-cluster";
my $backupdir = "/var/lib/pve-cluster/backup";
my $dbfile = "$libdir/config.db";
my $authfile = "$libdir/corosync.authkey";
-sub ssh_remove_duplicate_keys {
- # remove duplicate keys in $sshauthkeys
- # ssh-copy-id simply add keys, so the file can grow to large
- my $data = PVE::Tools::file_get_contents($sshauthkeys, 128*1024);
-
- my $newdata = "";
- my $vhash = {};
- while ($data =~ s/^(.*?\n)//m) {
- my $line = $1;
- if ($line =~ m/^ssh-rsa\s+\S+\s+(\S+)$/) {
- $vhash->{$1} = $line;
- } else {
- $newdata .= $line;
- }
- }
-
- $newdata .= join("", values(%$vhash));
-
- PVE::Tools::file_set_contents($sshauthkeys, $newdata, 0600);
-}
-
-sub setup_ssh_keys {
-
- # create ssh key if it does not exist
- if (! -f $ssh_rsa_id) {
- mkdir '/root/.ssh/';
- system ("echo|ssh-keygen -t rsa -N '' -b 2048 -f ${ssh_rsa_id_priv}");
- }
-
- mkdir "$basedir/priv";
-
- if (! -f $sshauthkeys) {
- my $fh = IO::File->new ($sshauthkeys, O_CREAT|O_WRONLY|O_EXCL, 0400);
- close($fh);
- }
-
- warn "can't create shared ssh key database '$sshauthkeys'\n"
- if ! -f $sshauthkeys;
-
- if (-f $rootsshauthkeys) {
- system("mv '$rootsshauthkeys' '$rootsshauthkeys.org'");
- }
-
- if (! -l $rootsshauthkeys) {
- symlink $sshauthkeys, $rootsshauthkeys;
- }
- warn "can't create symlink for ssh keys '$rootsshauthkeys' -> '$sshauthkeys'\n"
- if ! -l $rootsshauthkeys;
-
-}
-
sub backup_database {
print "backup old database\n";
@@ -254,9 +199,7 @@
;
PVE::Tools::file_set_contents($clusterconf, $config);
- # add ourself to authorized keys (use by other nodes)
- my $pub = PVE::Tools::file_get_contents($ssh_rsa_id);
- PVE::Tools::file_set_contents($sshauthkeys, $pub);
+ PVE::Cluster::ssh_merge_keys();
PVE::Cluster::gen_pve_node_files($nodename, $local_ip_address);
@@ -307,7 +250,7 @@
die "cluster not ready - no quorum?\n";
}
- eval { ssh_remove_duplicate_keys(); };
+ eval { ssh_merge_keys(); };
warn $@ if $@;
my $lst = lsnode();
@@ -643,7 +586,7 @@
PVE::Cluster::check_cfs_is_mounted();
-setup_ssh_keys();
+PVE::Cluster::setup_ssh_keys();
PVE::Cluster::cfs_update();
Modified: pve-cluster/trunk/debian/changelog
===================================================================
--- pve-cluster/trunk/debian/changelog 2011-08-09 04:24:26 UTC (rev 6434)
+++ pve-cluster/trunk/debian/changelog 2011-08-09 06:22:17 UTC (rev 6435)
@@ -1,3 +1,9 @@
+pve-cluster (1.0-4) unstable; urgency=low
+
+ * also handle ssh known_hosts file
+
+ -- Proxmox Support Team <support at proxmox.com> Tue, 09 Aug 2011 08:21:12 +0200
+
pve-cluster (1.0-3) unstable; urgency=low
* new virtual file to enabe/disable debugging
Modified: pve-cluster/trunk/debian/postinst
===================================================================
--- pve-cluster/trunk/debian/postinst 2011-08-09 04:24:26 UTC (rev 6434)
+++ pve-cluster/trunk/debian/postinst 2011-08-09 06:22:17 UTC (rev 6435)
@@ -27,7 +27,7 @@
if test ! -e /proxmox_install_mode; then
invoke-rc.d pve-cluster restart
invoke-rc.d rsyslog restart
- pvecert
+ pvecert --silent
fi
;;
More information about the pve-devel
mailing list