Wrong access permissions of authorized keys directory when using root-owned location

This bug was originally filed in Launchpad as [LP: #1839061](https://bugs.launchpad.net/cloud-init/+bug/1839061)

Launchpad details

affected_projects = []

assignee = None

assignee_name = None

date_closed = None

date_created = 2019-08-06T07:07:43.699620+00:00

date_fix_committed = None

date_fix_released = None

id = 1839061

importance = medium

is_complete = False

lp_url = https://bugs.launchpad.net/cloud-init/+bug/1839061

milestone = None

owner = ansreas

owner_name = Andreas Florath

private = False

status = triaged

submitter = ansreas

submitter_name = Andreas Florath

tags = ['4010']

duplicates = []

_Launchpad user **Andreas Florath(ansreas)** wrote on 2019-08-06T07:07:43.699620+00:00_

When using a central, root-owned directory to store ssh keys, cloud-init changes the permissions of the key directory which renders the keys unusable.

I'm using a similar approach as described here:
https://www.ssh.com/ssh/key/
MOVING SSH KEYS TO A ROOT-OWNED LOCATION

but I'm using the config

AuthorizedKeysFile /etc/ssh/keys/%u

In the original image, the permissions of the keys directory /etc/ssh/keys are 0755 - owned by root:root. It contains all the keys of the users. All keys have 0644 permissions and are also owned by root:root. (The background: Users are not allowed to change their ssh keys.)

After the machine boots and cloud-init finishes, the permissions of the key directory /etc/ssh/keys is 0700 and it is impossible to use key-authentication, because sshd cannot access the key files.

IMHO the reason for this is, that cloud-init changes the permission of the keys directory

https://git.launchpad.net/cloud-init/tree/cloudinit/ssh_util.py#n259

util.ensure_dir(os.path.dirname(auth_key_fn), mode=0o700)

which is wrong in this use case.