canonical / canonical/cloud-init

Configuring a user should not configure root's authorized_keys

Open
#3,648 3 comments 0 reactions 0 assignees View on GitHub
enhancement launchpad
Dominant language
Python
Stars
3.8k
Forks
1.1k
Avg merge
2d 23h
Merged PRs (30d)
18

Description

This bug was originally filed in Launchpad as [LP: #1871879](https://bugs.launchpad.net/cloud-init/+bug/1871879)

Launchpad details

affected_projects = []

assignee = None
assignee_name = None
date_closed = None
date_created = 2020-04-09T16:53:41.587279+00:00
date_fix_committed = None
date_fix_released = None
id = 1871879
importance = wishlist
is_complete = False
lp_url = https://bugs.launchpad.net/cloud-init/+bug/1871879
milestone = None
owner = apollo13
owner_name = Florian Apolloner
private = False
status = triaged
submitter = apollo13
submitter_name = Florian Apolloner
tags = []
duplicates = []

_Launchpad user **Florian Apolloner(apollo13)** wrote on 2020-04-09T16:53:41.587279+00:00_

When `ssh_authorized_keys` is configured in user-data keys are unconditionally copied into /root/.ssh/authorized_keys.

If `disable_root` is set to true it leaks the actual configured username: "Please login as the user XYZ rather than the user root." With `disable_root` set to false you can login.

It would be great if there were a way to actually disable root and not touch it at all. I fully understand that the info message is useful for new users, but it would be great to have a way to leave root alone.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.