puppetlabs / puppetlabs/puppetlabs-sshkeys_core
centralized location of keys and drop_privileges = false works in debug mode only
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 3
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
Describe the Bug
When using a centralized location for keys, e.g. /etc/ssh/authorized_keys, that is owned by root, a trusted path error occurs. However, files are created successfully when --debug is used.
Expected Behavior
Trusted path should succeed without running puppet in debug mode.
Steps to Reproduce
Steps to reproduce the behavior:
- Add a key with target of, e.g., /etc/ssh/authorized_keys/$user and use "drop_privileges => false".
- Run puppet agent -t
Note trusted path error and the key file is not created. - Run puppet agent -t --debug
No error and keyfile is created.
Environment
- Version 7.34.0
- Platform: Oracle Linux 8
Additional Context
This is somewhat related to #92 . In secure environments, keys are usually managed in central location and key files are owned by root(or other admin user) or not writable by the user.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with puppet agent -t and compare it with puppet agent -t --debug using a centralized /etc/ssh/authorized_keys/$user target and drop_privileges => false. Trace the trusted-path and key-file creation behavior, then verify that the non-debug run succeeds without changing ownership requirements.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100