[BUG] 'ssh-keygen’ permission denied for deployment with public key.

**Describe the bug**

Waagent is generating an error message in the deployment of a CentOS version 7.0.1406 (Core) (unsupported version) when uses ‘ssh-keygen’ to change the format of the public key and store it in the “$HOME/.ssh/authorized_keys” of the admin user.
This is with an image of a CentOS that was uploaded from on-prem and generalized, and the waagent was installed from the Github waagent version 2.2.42.

1. Section of the log where the error occurs.

```
2019/08/09 22:39:08.885164 INFO Daemon Configure sshd
2019/08/09 22:39:08.890028 INFO Daemon Disabled SSH password-based authentication methods.
2019/08/09 22:39:08.895750 INFO Daemon Configured SSH client probing to keep connections alive.
2019/08/09 22:39:08.902239 INFO Daemon Deploy ssh public key.
2019/08/09 22:39:09.031523 ERROR Daemon Command: [ssh-keygen -i -m PKCS8 -f /var/lib/waagent/DABF3513C4C6D93CFCBC2EEFDC0D64173AA1F096.pub >> /home/remediate/.ssh/authorized_keys], return code: [255], result: [ssh-keygen: /var/lib/waagent/DABF3513C4C6D93CFCBC2EEFDC0D64173AA1F096.pub: Permission denied]
2019/08/09 22:39:13.667897 INFO Daemon Provisioning complete
```

2. Serial console output: not errors in serial console
3. Steps to reproduce the behavior:

• Waagent is generating an error message in the deployment of a CentOS version 7.0.1406 (Core) (unsupported version) when uses ‘ssh-keygen’ to change the format of the public key and store it in the “$HOME/.ssh/authorized_keys” of the admin user.
• This is with an image of a CentOS that was uploaded from on-prem and generalized, and the waagent was installed from the Github waagent version 2.2.42.
• The issue is only reproducible with the image uploaded.

**Distro and WALinuxAgent details:**

- Distro and Version: CentOS version 7.0.1406 (Core)
- WALinuxAgent version: 2.2.42

**Additional context**

We created another virtual machine using the same image and proceed to check the permissions, owner:group, selinux fcontext but they are the same that the defaults present in a marketplace image:

```
sudo ls -lZ /var/lib/waagent/
[root@troubleshoot ~]# ls -lZ /var/lib/waagent/
-r--------. root root system_u:object_r:init_var_lib_t:s0 8A8F6DFA853F56A9584592873CE433AF361A8918.crt
-rw-------. root root unconfined_u:object_r:ssh_home_t:s0 8A8F6DFA853F56A9584592873CE433AF361A8918.pub
```

Once one of the affected virtual machines is created we can use the Azure feature “Reset password” to reset the public key and we can recover the access, however, it uses an extension and the process is different.
We tried to manually execute the “ssh-keygen” command with the key from the deployment and it did not return any error:

```
sudo ssh-keygen -i -m PKCS8 -f /var/lib/waagent/*.pub >> /home/remediate/.ssh/authorized_keys

[root@troubleshoot ~]# ssh-keygen -i -m PKCS8 -f /var/lib/waagent/*.pub >> /home/remediate/.ssh/authorized_keys
[root@troubleshoot ~]# echo $?
0
```

The CentOS version is required, may this be the cause of the issue or is there anything we are not considering?

Thanks in advance.

Start with the logged “Deploy ssh public key” step and the ssh-keygen command shown in the report. Reproduce it using the uploaded CentOS 7.0.1406 image and WALinuxAgent 2.2.42, then compare that failure with the successful manual command and the reported permissions and SELinux context. Done means identifying the cause and documenting or implementing a verified fix.

Written by the indexing model from the issue text.