[Bug 2049860] Re: cloud-init cloud-config for ssh broken in jammy

[John Chittum]

Tested working on the image from http://cloud-
images.ubuntu.com/releases/jammy/release-20240319/

$ ssh -o "UserKnownHostsFile=/dev/null -o CheckHostIP=no StrictHostKeyChecking no" jchittum at 0.0.0.0 -p 2222
The authenticity of host '[0.0.0.0]:2222 ([0.0.0.0]:2222)' can't be established.
ED25519 key fingerprint is <REDACTED>
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[0.0.0.0]:2222' (ED25519) to the list of known hosts.
jchittum at 0.0.0.0's password: 
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

  System information as of Mon Apr  1 11:55:56 UTC 2024

$ ls /etc/ssh/sshd_config.d/
50-cloud-init.conf  60-cloudimg-settings.conf

$ sudo cat /etc/ssh/sshd_config.d/50-cloud-init.conf 
PasswordAuthentication yes

$ sudo cat /etc/ssh/sshd_config.d/60-cloudimg-settings.conf 
PasswordAuthentication no


####

cloud-init and passwords is a bit confusing. here is a working example
of a cloud-init:

#cloud-config
ssh_pwauth: true
users:
    - name: jchittum
      groups: [adm, lxd, sudo]
      passwd: <HASHED_PASSWORD>
      sudo: ALL=(ALL) NOPASSWD:ALL
      shell: /bin/bash
      lock_passwd: false
    - name: timmy
      groups: [adm, lxd, sudo, cdrom, dip]
      ssh_import_id: lp:jchittum
      sudo: ALL=(ALL) NOPASSWD:ALL
      passwd: <HASHED_PASSWD>
      shell: /bin/bash
      lock_passwd: false


NOTES:

passwd was set by running : mkpasswd --method=SHA-512 --rounds=500000
lock_passwd: false is _required_ to make this work. otherwise providing a password won't do anything, and you'll never be able to log in.

I'm wondering if it's from a different version of cloud-init instead?

20231211:
cloud-init 	23.3.3-0ubuntu0~22.04.1 

20240319:
cloud-init 	23.4.4-0ubuntu0~22.04.1 

i don't see anything related in the
changelog[https://github.com/canonical/cloud-init/blob/main/ChangeLog]

next steps: try a coud-init config like i have above. If it fails,
please provide your cloud-init and outputs (especially helpful with some
cloud-init logs).

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2049860

Title:
  cloud-init cloud-config for ssh broken in jammy

Status in cloud-images:
  Fix Committed
Status in cloud-images focal series:
  New
Status in livecd-rootfs package in Ubuntu:
  Confirmed
Status in livecd-rootfs source package in Focal:
  Fix Released
Status in livecd-rootfs source package in Jammy:
  Fix Released

Bug description:
  [impact]
  cloud-config overrides via cloud-init for ssh do no longer work. Eg.

  #cloud-config
  ssh_pwauth: True

  doesn't enable password authentication anymore.

  The reason is that https://git.launchpad.net/livecd-
  rootfs/commit/live-build/ubuntu-
  cpc/hooks.d/chroot/052-ssh_authentication.chroot?h=ubuntu/jammy&id=3b2eeb017153cbbfc8935f9447e00d196e34d983
  is a wrong backport using the wrong filename
  /etc/ssh/sshd_config.d/10-cloudimg-settings.conf . it needs to be
  /etc/ssh/sshd_config.d/60-cloudimg-settings.conf . See
  https://git.launchpad.net/livecd-rootfs/tree/live-build/ubuntu-
  cpc/hooks.d/chroot/052-ssh_authentication.chroot?h=ubuntu/master which
  is the correct change in the ubuntu/master branch.

  This bug needs only fixing in Jammy and Focal because the fix is
  correct in > Jammy. Jammy has this bug already in the -updates pocket
  but Focal only has the wrong fix in its git branch.

  [test plan]
  * build an image with the proposed fix
  * use a cloud-init cloud-config data to enable ssh password auth (which is disabled by default)
  * check after image boot with "sshd -T" if password authentication is enabled
  * make sure that the file written by cloud-init in /etc/ssh/sshd_config.d/ has a lower number than the file from the image (cloudimg-settings.conf)

  [ Where problems could occur ]
  The change does rename a single file to have correct ordering between the prebuilt cloud images and cloud-init. There are edge-cases where this could create problems but those are acceptable:

  - rebuilt images based on the Ubuntu image which try to delete
  10-cloudimg-settings.conf would no longer work

  But in general this is a bug fix for the changes introduced in
  LP:#1968873

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-images/+bug/2049860/+subscriptions