when multiple SSH host key certificates are defined, only one HostCertificate is referenced in sshd_config

Bug #1999164 reported by Robert Jacobson
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
cloud-init
Fix Released
High
Alberto Contreras

Bug Description

I'm not using a cloud provider; I'm installing Ubuntu 20.04 using autoinstall and the bug is triggered during cloud-init with user-data ( cloud-init 22.4.2-0ubuntu0~20.04.1 )

I defined 3 types of SSH host keys and certs in user-data. All 3 keys and certs ended up in /etc/ssh/, but in sshd_config, there is only one HostCertificate line for the RSA key.

user-data excerpt:

#cloud-config
autoinstall:
  version: 1
[...]
  user-data:
    timezone: UTC
    disable_root: false
    ssh_deletekeys: false
    ssh_genkeytypes: [rsa, ecdsa, ed25519]
    ssh_keys:
      rsa_private: |
        [REDACTED]
      rsa_public: |
        [REDACTED]
      rsa_certificate: |
        [REDACTED]
      ecdsa_private: |
        [REDACTED]
      ecdsa_public: |
        [REDACTED]
      ecdsa_certificate: |
        [REDACTED]
      ed25519_private: |
        [REDACTED]
      ed25519_public: |
        [REDACTED]
      ed25519_certificate: |
        [REDACTED]

Result:
in /etc/sshd/sshd_config, only one cert line: HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub

Revision history for this message
Robert Jacobson (teridon) wrote :
Revision history for this message
Robert Jacobson (teridon) wrote :
Revision history for this message
James Falcon (falcojr) wrote :

Reproduced on LXD using the cloud-config (minus the autoinstall). Triaging as high since it's ssh-related.

Changed in cloud-init:
status: New → Confirmed
importance: Undecided → High
Revision history for this message
Alberto Contreras (aciba) wrote :

Tracking it in SC-1425.

Revision history for this message
Alberto Contreras (aciba) wrote :
Changed in cloud-init:
assignee: nobody → Alberto Contreras (aciba)
status: Confirmed → In Progress
Changed in cloud-init:
status: In Progress → Fix Committed
Revision history for this message
Alberto Contreras (aciba) wrote : Fixed in cloud-init version 23.1.

This bug is believed to be fixed in cloud-init in version 23.1. If this is still a problem for you, please make a comment and set the state back to New

Thank you.

Changed in cloud-init:
status: Fix Committed → Fix Released
Revision history for this message
James Falcon (falcojr) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.