diff --git a/lib/vagrant/errors.rb b/lib/vagrant/errors.rb index b1ec6f35c..623073a97 100644 --- a/lib/vagrant/errors.rb +++ b/lib/vagrant/errors.rb @@ -620,6 +620,10 @@ module Vagrant error_key(:ssh_invalid_shell) end + class SSHInsertKeyUnsupported < VagrantError + error_key(:ssh_insert_key_unsupported) + end + class SSHIsPuttyLink < VagrantError error_key(:ssh_is_putty_link) end diff --git a/plugins/communicators/ssh/communicator.rb b/plugins/communicators/ssh/communicator.rb index cb9452d1c..35506e31e 100644 --- a/plugins/communicators/ssh/communicator.rb +++ b/plugins/communicators/ssh/communicator.rb @@ -11,6 +11,7 @@ require 'net/scp' require 'vagrant/util/ansi_escape_code_remover' require 'vagrant/util/file_mode' +require 'vagrant/util/keypair' require 'vagrant/util/platform' require 'vagrant/util/retryable' @@ -88,6 +89,8 @@ module VagrantPlugins raise rescue Vagrant::Errors::SSHKeyBadPermissions raise + rescue Vagrant::Errors::SSHInsertKeyUnsupported + raise rescue Vagrant::Errors::VagrantError => e # Ignore it, SSH is not ready, some other error. end @@ -142,20 +145,41 @@ module VagrantPlugins # If we used a password, then insert the insecure key ssh_info = @machine.ssh_info - if ssh_info[:password] && ssh_info[:private_key_path].empty? - @logger.info("Inserting insecure key to avoid password") - @machine.ui.info(I18n.t("vagrant.inserting_insecure_key")) - @machine.guest.capability( - :insert_public_key, - Vagrant.source_root.join("keys", "vagrant.pub").read.chomp) + insert = ssh_info[:password] && ssh_info[:private_key_path].empty? + ssh_info[:private_key_path].each do |pk| + if insecure_key?(pk) + insert = true + @machine.ui.detail("\n"+I18n.t("vagrant.inserting_insecure_detected")) + break + end + end + + if insert + # If we don't have the power to insert/remove keys, then its an error + cap = @machine.guest.capability?(:insert_public_key) && + @machine.guest.capability?(:remove_public_key) + raise Vagrant::Errors::SSHInsertKeyUnsupported if !cap + + _pub, priv, openssh = Vagrant::Util::Keypair.create + + @logger.info("Inserting key to avoid password: #{openssh}") + @machine.ui.detail("\n"+I18n.t("vagrant.inserting_random_key")) + @machine.guest.capability(:insert_public_key, openssh) # Write out the private key in the data dir so that the # machine automatically picks it up. @machine.data_dir.join("private_key").open("w+") do |f| - f.write(Vagrant.source_root.join("keys", "vagrant").read) + f.write(priv) end - @machine.ui.info(I18n.t("vagrant.inserted_key")) + # Remove the old key if it exists + @machine.ui.detail(I18n.t("vagrant.inserting_remove_key")) + @machine.guest.capability( + :remove_public_key, + Vagrant.source_root.join("keys", "vagrant.pub").read.chomp) + + # Done, restart. + @machine.ui.detail(I18n.t("vagrant.inserted_key")) @connection.close @connection = nil @@ -597,6 +621,16 @@ module VagrantPlugins # Otherwise, just raise the error up raise end + + # This will test whether path is the Vagrant insecure private key. + # + # @param [String] path + def insecure_key?(path) + return false if !path + return false if !File.file?(path) + source_path = Vagrant.source_root.join("keys", "vagrant") + return File.read(path).chomp == source_path.read.chomp + end end end end diff --git a/plugins/guests/linux/cap/remove_public_key.rb b/plugins/guests/linux/cap/remove_public_key.rb new file mode 100644 index 000000000..a8d773a40 --- /dev/null +++ b/plugins/guests/linux/cap/remove_public_key.rb @@ -0,0 +1,21 @@ +require "vagrant/util/shell_quote" + +module VagrantPlugins + module GuestLinux + module Cap + class RemovePublicKey + def self.remove_public_key(machine, contents) + contents = contents.chomp + contents = Vagrant::Util::ShellQuote.escape(contents, "'") + + machine.communicate.tap do |comm| + if comm.test("test -f ~/.ssh/authorized_keys") + comm.execute( + "sed -i '/^.*#{contents}.*$/d' ~/.ssh/authorized_keys") + end + end + end + end + end + end +end diff --git a/plugins/guests/linux/plugin.rb b/plugins/guests/linux/plugin.rb index a2bb1167c..cadd4aa95 100644 --- a/plugins/guests/linux/plugin.rb +++ b/plugins/guests/linux/plugin.rb @@ -62,6 +62,11 @@ module VagrantPlugins Cap::ReadIPAddress end + guest_capability("linux", "remove_public_key") do + require_relative "cap/remove_public_key" + Cap::RemovePublicKey + end + guest_capability("linux", "rsync_installed") do require_relative "cap/rsync" Cap::RSync diff --git a/templates/locales/en.yml b/templates/locales/en.yml index 9fc465aac..333091fbb 100644 --- a/templates/locales/en.yml +++ b/templates/locales/en.yml @@ -130,8 +130,13 @@ en: Starting Docker containers... inserted_key: |- Key inserted! Disconnecting and reconnecting using new SSH key... - inserting_insecure_key: |- - Inserting Vagrant public key within guest... + inserting_insecure_detected: |- + Vagrant insecure key detected. Vagrant will automatically replace + this with a newly generated keypair for better security. + inserting_random_key: |- + Inserting generated public key within guest... + inserting_remove_key: |- + Removing insecure key from the guest if its present... list_commands: |- Below is a listing of all available Vagrant commands and a brief description of what they do. @@ -1071,6 +1076,16 @@ en: using a shell that is unavailable on the system. Please verify you're using the full path to the shell and that the shell is executable by the SSH user. + ssh_insert_key_unsupported: |- + Vagrant is configured to generate a random keypair and insert it + onto the guest machine, but it appears Vagrant doesn't know how to do + this with your guest OS. Please disable key insertion by setting + `config.ssh.insert_key = false` in the Vagrantfile. + + After doing so, run `vagrant reload` for the setting to take effect. + + If you'd like Vagrant to learn how to insert keys on this OS, please + open an issue with details about your environment. ssh_is_putty_link: |- The `ssh` executable found in the PATH is a PuTTY Link SSH client. Vagrant is only compatible with OpenSSH SSH clients. Please install