cloud-set-guest-sshkey-password-userdata-configdrive.in

#!/usr/bin/env bash

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

username=root
userDataServerPort=8080
configDriveLabel=config-2

function findPrimaryNetwork(){
    outputLog "Detecting primary network"
    if command -v ip &> /dev/null
    then
        primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
    elif command -v netstat &> /dev/null
    then
        primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
    elif command -v route &> /dev/null
    then
        primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
        if [ -z "$primaryNet" ]
        then
            primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
        fi
    fi
    if [ -z "$primaryNet" ]
    then
        outputLog "Could not find primary network"
        return 1
    fi
    echo "$primaryNet"
    return 0
}

function findUserDataServer(){
    primaryNet=$1
    outputLog "Trying to find userdata server"
    if [ -z "$primaryNet" ]
    then
        outputLog "Unable to determine the userdata server, falling back to data-server"
        echo "data-server"
        return 0
    fi

    if command -v netplan &> /dev/null
    then
        outputLog "Operating System is using netplan"

        userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')

        if [ -n "$userDataServer" ]
        then
            outputLog "Found userdata server IP $userDataServer in netplan config"
            echo "$userDataServer"
            return 0
        fi
    fi

    if command -v nmcli &> /dev/null
    then
        outputLog "Operating System is using NetworkManager"

        userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')

        if [ -n "$userDataServer" ]
        then
            outputLog "Found userdata server IP $userDataServer in NetworkManager config"
            echo "$userDataServer"
            return 0
        fi
    fi

    if command -v wicked &> /dev/null
    then
        outputLog "Operating System is using wicked"

        userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')

        if [ -n "$userDataServer" ]
        then
            outputLog "Found userdata server IP $userDataServer in wicked config"
            echo "$userDataServer"
            return 0
        fi
    fi

    if command -v udhcpc &> /dev/null
    then
        outputLog "Operating System is using udhcpc"

        userDataServer=$(< /run/dhcp-server-ip."$primaryNet")

        if [ -n "$userDataServer" ]
        then
            outputLog "Found userdata server IP $userDataServer in udhcpc"
            echo "$userDataServer"
            return 0
        fi
    fi

    outputLog "Searching for DHCP server in lease files"

    primaryLease=$(
        dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
        for files in $dhcpFolders
        do
            if [ -e "$files" ]
            then
                < "$files" tr -d '\n' | sed 's/  //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
            fi
        done
    )

    serverList=$(
        IFS=$'\n'
        for line in $(echo -e "$primaryLease")
        do
            splitLine=$(echo "$line" | sed -e 's/;/\n/g')
            if date -j &> /dev/null
            then
                timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
            else
                timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
            fi
            interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
            server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
            echo "$timestamp","$interface","$server"
        done
    )

    userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')

    if [ -n "$userDataServer" ]
    then
        outputLog "Userdata server found: $userDataServer"
        echo "$userDataServer"
        return 0
    fi

    outputLog "Unable to determine the userdata server, falling back to data-server"
    echo "data-server"
    return 0
}

function getPasswordFromUserDataServer(){
    userDataServer=$1
    userDataServerPort=$2
    outputLog "Sending request to userdata server at $userDataServer to get the password"
    if ! response=$(curl --fail --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
    then
        outputLog "Failed to send request to userdata server at $userDataServer"
        return 4
    fi
    outputLog "Got response from userdata server at $userDataServer"
    response=$(echo "$response" | tr -d '\r')
    case $response in
        "")
            outputLog "Userdata server at $userDataServer did not have any password for the VM"
            return 2
        ;;
        "bad_request")
            outputLog "VM sent an invalid request to userdata server at $userDataServer"
            return 3
        ;;
        "saved_password")
            outputLog "VM has already saved a password from the userdata server at $userDataServer"
            return 1
        ;;
        *)
            outputLog "VM got a valid password from server at $userDataServer"
            echo "$response"
            return 0
    esac
}

function findHomeDirectory(){
    username=$1
    getent passwd "$username"|awk -F ":" '{print $6}'
}

function setPassword(){
    username=$1
    homeDir=$2
    password=$3
    if command -v md5sum &> /dev/null
    then
        newMd5=$(echo "$password" | md5sum | awk '{print $1}')
    elif command -v md5 &> /dev/null
    then
        newMd5=$(echo "$password" | md5)
    else
        newMd5='N/A'
    fi
    if [ $newMd5 != 'N/A' ]
    then
        if [ -f "$homeDir"/.password.md5 ]
        then
            oldMd5=$(cat "$homeDir"/.password.md5)
        fi
        if [ "$newMd5" ==  "$oldMd5" ]
        then
            outputLog  "There is no update of VM password"
            return 0
        fi
    else
        outputLog "Cannot determine change of password"
    fi
    outputLog "Changing password for user $username"
    if command -v chpasswd &> /dev/null
    then
        echo "$username":"$password" | chpasswd
    elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
    then
        usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
    elif command -v pw &> /dev/null
    then
        echo "$password" | pw mod user "$username" -h 0
    else
        outputLog "Failed to change password for user $username"
        return 1
    fi
    outputLog "Successfully changed password for user $username"
    if [ $newMd5 != 'N/A' ]
    then
        echo "$newMd5" > "$homeDir"/.password.md5
        chmod 600 "$homeDir"/.password.md5
        chown "$username": "$homeDir"/.password.md5
    fi
    return 0
}

function sendAckToUserDataServer(){
    userDataServer=$1
    userDataServerPort=$2
    outputLog "Sending acknowledgment to userdata server at $userDataServer"
    if ! curl --fail --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
    then
        outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
        return 1
    fi
    outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
    return 0
}

function getPublicKeyFromUserDataServer(){
    userDataServer=$1
    outputLog "Sending request to userdata server at $userDataServer to get public key"
    if ! response=$(curl --fail --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
    then
        outputLog "Failed to get public key from userdata server"
        return 2
    fi
    outputLog "Got response from userdata server at $userDataServer"
    if [ -z "$response" ]
    then
        outputLog "Did not receive any public keys from userdata server"
        return 1
    fi
    outputLog "Successfully get public key from userdata server"
    echo "$response"
    return 0
}

function setPublicKey(){
    username=$1
    homeDir=$2
    publicKey=$3
    outputLog "Applying public key for $username"
    sshDir=$homeDir/.ssh
    authorizedKeysFile=$sshDir/authorized_keys

    if [ ! -d "$sshDir" ]
    then
        outputLog ".ssh directory for $username not found, creating .ssh directory"
        mkdir "$sshDir"
    fi

    if [ ! -f "$authorizedKeysFile" ]
    then
        outputLog "authorized_keys file for $username not found, creating authorized_keys file"
        touch "$authorizedKeysFile"
    fi
    if grep "$(echo "$publicKey" | awk '{print $2}')" "$authorizedKeysFile" > /dev/null
    then
        outputLog "No need to update authorized_keys file"
        return 0
    fi
    outputLog "Writing public key in authorized_keys file"
    sed -i "/ cloudstack@apache.org$/d" "$authorizedKeysFile"
    echo "$publicKey cloudstack@apache.org" >> "$authorizedKeysFile"
    chmod 600 "$authorizedKeysFile"
    chmod 700 "$sshDir"
    chown -R "$username": "$sshDir"
    which restorecon &> /dev/null && restorecon -R -v "$sshDir"
    return 0
}

function findConfigDrive(){
    configDriveLabel=$1
    outputLog "Searching for ConfigDrive"

    if [ -e /dev/disk/by-label/"$configDriveLabel" ]
    then
        outputLog "ConfigDrive found at /dev/disk/by-label/$configDriveLabel"
        echo "/dev/disk/by-label/$configDriveLabel"
        return 0
    fi

    if [ -e /dev/iso9660/"$configDriveLabel" ]
    then
        outputLog "ConfigDrive found at /dev/iso9660/$configDriveLabel"
        echo "/dev/iso9660/$configDriveLabel"
        return 0
    fi

    blockDevice=$(blkid -t LABEL="$configDriveLabel" /dev/hd? /dev/sd? /dev/xvd? /dev/vd? /dev/sr? -o device 2> /dev/null)
    if [ -n "$blockDevice" ]
    then
        outputLog "ConfigDrive found at $blockDevice"
        echo "$blockDevice"
        return 0
    fi
    outputLog "ConfigDrive not found"
    return 1
}

function mountConfigDrive(){
    disk=$1
    outputLog "Mounting ConfigDrive"
    mountDir=$(mktemp -d)
    if [ ! -e "$mountDir" ]
    then
        mkdir "$mountDir"
        chmod 700 "$mountDir"
    fi

    mounted=0
    if [ $mounted == 0 ] && mount -r "$disk" "$mountDir" &> /dev/null
    then
        mounted=1
    fi
    if [ $mounted == 0 ] && mount -r -t cd9660 "$disk" "$mountDir" &> /dev/null
    then
        mounted=1
    fi
    if [ $mounted == 0 ] && mount -r -t iso9660 "$disk" "$mountDir" &> /dev/null
    then
        mounted=1
    fi

    if [ $mounted == 1 ]
    then
        outputLog "$disk successfully mounted on $mountDir"
        echo "$mountDir"
        return 0
    fi

    outputLog "Failed mounting $disk on $mountDir"
    rm -rf "$mountDir"
    return 1
}

function unmountConfigDrive(){
    mountDir=$1
    outputLog "Unmounting ConfigDrive"
    if ! umount "$mountDir"
    then
        outputLog "Failed unmounting $mountDir"
        return 1
    fi
    rm -rf "$mountDir"
    outputLog "Successfully unmount $mountDir"
    return 0
}

function getPasswordFromConfigDrive(){
    mountDir=$1
    passwordFile=$mountDir/cloudstack/password/vm_password.txt
    if [ ! -f "$passwordFile" ]
    then
        outputLog "Password file not found in ConfigDrivee"
        return 3
    fi
    outputLog "Password file found in ConfigDrive"
    content=$(< "$passwordFile" tr -d '\r')

    case $content in

        "")
            outputLog "ConfigDrive did not have any password for the VM"
            return 2
        ;;

        "saved_password")
            outputLog "VM has already saved a password"
            return 1
        ;;

        *)
            outputLog "VM got a valid password"
            echo "$content"
            return 0
    esac
}

function getPublicKeyFromConfigDrive() {
    mountDir=$1
    publicKeyFile=$mountDir/cloudstack/metadata/public-keys.txt

    if [ ! -f "$publicKeyFile" ]
    then
        outputLog "Public key file not found in ConfigDrive"
        return 2
    fi
    content=$(< "$publicKeyFile" tr -d '\r')

    if [ -z "$content" ]
    then
        outputLog "Did not receive any public keys"
        return 1
    fi
    echo "$content"
    outputLog "Public key successfully received."
    return 0
}

function outputLog() {
    stderr=1
    logger=1
    message=$1
    if [ $stderr == 1 ]
    then
        echo "Cloud Password Manager: $message" 1>&2
    fi
    if [ $logger == 1 ]
    then
        logger -t "Cloud Password Manager" "$message"
    fi
}

publicKeyReceived=0
passwordReceived=0
dataSource=''

if disk=$(findConfigDrive "$configDriveLabel")
then
    if mountDir=$(mountConfigDrive "$disk")
    then
        dataSource='ConfigDrive'
        if publicKey=$(getPublicKeyFromConfigDrive "$mountDir")
        then
            publicKeyReceived=1
        fi
        if password=$(getPasswordFromConfigDrive "$mountDir")
        then
            passwordReceived=1
        fi
        unmountConfigDrive "$mountDir"
    fi
fi
if [ $publicKeyReceived == 0 ] || [ $passwordReceived == 0 ]
then
    primaryNet=$(findPrimaryNetwork)
    userDataServer=$(findUserDataServer "$primaryNet")
    if [ $publicKeyReceived == 0 ]
    then
        if publicKey=$(getPublicKeyFromUserDataServer "$userDataServer")
        then
            dataSource='UserDataServer'
            publicKeyReceived=1
        fi
    fi
    if [ $passwordReceived == 0 ]
    then
        if password=$(getPasswordFromUserDataServer "$userDataServer" "$userDataServerPort")
        then
            dataSource='UserDataServer'
            passwordReceived=1
        fi
    fi
fi
homeDir=$(findHomeDirectory "$username")
if [ $passwordReceived == 1 ]
then
    setPassword "$username" "$homeDir" "$password"
    if [ $dataSource == 'UserDataServer' ]
    then
        sendAckToUserDataServer "$userDataServer" "$userDataServerPort"
    fi
fi
if [ $publicKeyReceived == 1 ]
then
    setPublicKey "$username" "$homeDir" "$publicKey"
fi