lando / lando/core

SSH keys from host not configured in container due to apparent error in load-keys.sh

Open
#53 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
62
Forks
41
Avg merge
2h 1m
Merged PRs (30d)
2

Description

Issue summary
Upon building and starting new containers, ssh keys from the host located in ~/.ssh correctly get mounted under /user/.ssh however they are not configured in the container's ssh_config file by the script: load-keys.sh.
-> This means that ssh will by default look for keys under the wrong location.

Apparent cause
After some debugging I noticed that load-keys.sh expect to be run by the root user and only load keys owned by $LANDO_WEBROOT_USER, which by default is user.
However, mounted keys automatically get assigned ownership of the current user. This can be reproduced by running ls -la /user/.ssh as both user and root.
Example:
Result as root:

-rw-------  1 root root 1831 Aug 12 00:28 id_rsa
-rw-r--r--  1 root root  405 Aug 12 00:28 id_rsa.pub

Result as user:

-rw-------  1 user dialout 1831 Aug 12 00:28 id_rsa
-rw-r--r--  1 user dialout  405 Aug 12 00:28 id_rsa.pub

Fix suggestion
Replace the following line with
readarray -t RAW_LIST < <(find "$SSH_DIR" -maxdepth 1 -not -name '*.pub' -not -name 'known_hosts' -type f) to prevent a user check which seems pointless since the SSH_CANDIDATE will be assigned correct permissions and ownership further down the same script.

Happy to make a PR if that helps.

Current config for reference:

  • Host machine: MacBook Pro M2 - Ventura 13.5.1
  • Lando v3.18.0
  • Docker host: OrbStack - 0.17.1

Project specific config:

recipe: lagoon
config:
  flavor: laravel

Container: Alpine Linux v3.18

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with plugins/lando-core/scripts/load-keys.sh around line 71 and compare its ownership check with the mounted files described in the issue. Reproduce the behavior in a Lando container using the provided ls commands, then verify that host keys are configured in the container's ssh_config and have the expected permissions and ownership.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell
Domain
infrastructure, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.