{"action":"created","issue":{"url":"https://api.github.com/repos/Azure/azure-linux-extensions/issues/218","repository_url":"https://api.github.com/repos/Azure/azure-linux-extensions","labels_url":"https://api.github.com/repos/Azure/azure-linux-extensions/issues/218/labels{/name}","comments_url":"https://api.github.com/repos/Azure/azure-linux-extensions/issues/218/comments","events_url":"https://api.github.com/repos/Azure/azure-linux-extensions/issues/218/events","html_url":"https://github.com/Azure/azure-linux-extensions/issues/218","id":169564123,"number":218,"title":"[VMAccessForLinux-1.4.1.0]reset ssh key in ARM mode will cause that user can login without password from any machine","user":{"login":"yuxisun1217","id":19280786,"avatar_url":"https://avatars.githubusercontent.com/u/19280786?v=3","gravatar_id":"","url":"https://api.github.com/users/yuxisun1217","html_url":"https://github.com/yuxisun1217","followers_url":"https://api.github.com/users/yuxisun1217/followers","following_url":"https://api.github.com/users/yuxisun1217/following{/other_user}","gists_url":"https://api.github.com/users/yuxisun1217/gists{/gist_id}","starred_url":"https://api.github.com/users/yuxisun1217/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yuxisun1217/subscriptions","organizations_url":"https://api.github.com/users/yuxisun1217/orgs","repos_url":"https://api.github.com/users/yuxisun1217/repos","events_url":"https://api.github.com/users/yuxisun1217/events{/privacy}","received_events_url":"https://api.github.com/users/yuxisun1217/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Azure/azure-linux-extensions/labels/VMAccess","name":"VMAccess","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"boumenot","id":91112,"avatar_url":"https://avatars.githubusercontent.com/u/91112?v=3","gravatar_id":"","url":"https://api.github.com/users/boumenot","html_url":"https://github.com/boumenot","followers_url":"https://api.github.com/users/boumenot/followers","following_url":"https://api.github.com/users/boumenot/following{/other_user}","gists_url":"https://api.github.com/users/boumenot/gists{/gist_id}","starred_url":"https://api.github.com/users/boumenot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boumenot/subscriptions","organizations_url":"https://api.github.com/users/boumenot/orgs","repos_url":"https://api.github.com/users/boumenot/repos","events_url":"https://api.github.com/users/boumenot/events{/privacy}","received_events_url":"https://api.github.com/users/boumenot/received_events","type":"User","site_admin":false},"assignees":[{"login":"boumenot","id":91112,"avatar_url":"https://avatars.githubusercontent.com/u/91112?v=3","gravatar_id":"","url":"https://api.github.com/users/boumenot","html_url":"https://github.com/boumenot","followers_url":"https://api.github.com/users/boumenot/followers","following_url":"https://api.github.com/users/boumenot/following{/other_user}","gists_url":"https://api.github.com/users/boumenot/gists{/gist_id}","starred_url":"https://api.github.com/users/boumenot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boumenot/subscriptions","organizations_url":"https://api.github.com/users/boumenot/orgs","repos_url":"https://api.github.com/users/boumenot/repos","events_url":"https://api.github.com/users/boumenot/events{/privacy}","received_events_url":"https://api.github.com/users/boumenot/received_events","type":"User","site_admin":false}],"milestone":null,"comments":7,"created_at":"2016-08-05T09:14:08Z","updated_at":"2016-08-25T20:58:35Z","closed_at":null,"body":"Description of problem:\r\nreset ssh key from Azure portal in ARM mode will cause that anyone can use this account to login without password\r\nOnly exists in ARM mode. Doesn't exist in ASM mode. \r\nprint protect_settings in vmaccess.py:\r\n{u'username': u'azureuser', u'password': u'', u'ssh_key': u'ssh-rsa xxx', u'reset_ssh': False}\r\n\r\nVersion-Release number of selected component:\r\nPlatform: RHEL-7\r\nExtension: VMAccessForLinux-1.4.1.0\r\n\r\nHow reproducible:\r\n100%\r\n\r\nSteps to Reproduce:\r\n1. Prepare a VM on Azure ARM mode. Username: azureuser. Authenticate with ssh key(no password)\r\n2. Reset SSH public key of \"azureuser\" account from https://portal.azure.com:\r\n    Virtual Machines -> All settings -> Reset password -> Reset SSH public key\r\n3. Login with azureuser from any machine. If asks password, input enter directly\r\n\r\nActual results:\r\nCan login use this account from any machine without password.\r\n\r\nExpected results:\r\nCan only login to this VM from the machine with the matched ssh key.\r\n\r\nLogs:\r\n/var/log/waagent:\r\n2016/08/05 16:43:28.019544 INFO [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Expected handler state: enabled\r\n2016/08/05 16:43:28.031937 INFO [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Decide which version to use\r\n2016/08/05 16:43:28.113530 INFO [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Use version: 1.4.1.0\r\n2016/08/05 16:43:28.126008 INFO [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Current handler state is: Enabled\r\n2016/08/05 16:43:28.139402 INFO [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Update settings file: 2.settings\r\n2016/08/05 16:43:28.151953 INFO [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Enable extension.\r\n2016/08/05 16:43:28.163486 INFO [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Launch command:./vmaccess.py -enable\r\n2016/08/05 16:43:28 VMAccess started to handle.\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] cwd is /var/lib/waagent/Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Change log file to /var/log/azure/Microsoft.OSTCExtensions.VMAccessForLinux/1.4.1.0/extension.log\r\n2016/08/05 16:43:29.199824 INFO Event: name=Microsoft.OSTCExtensions.VMAccessForLinux, op=Enable, message=Launch command succeeded: ./vmaccess.py -enable\r\n\r\n/var/log/azure/Microsoft.OSTCExtensions.VMAccessForLinux/1.4.1.0/extension.log:\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] sequence number is 2\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] setting file path is/var/lib/waagent/Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0/config/2.settings\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] JSON config: {\"runtimeSettings\": [{\"handlerSettings\": {\"protectedSettings\": \"MIIDdAYJKoZIhvcNAQcDoIIDZTCCA2ECAQAxggFpMIIBZQIBADBNMDkxNzA1BgoJkiaJk/IsZAEZFidXaW5kb3dzIEF6dXJlIENSUCBDZXJ0aWZpY2F0ZSBHZW5lcmF0b3ICEHmWDNflMJiOSecsAJYUG10wDQYJKoZIhvcNAQEBBQAEggEAfLH6mncPst4UEWH/9WBS1Q2n+NqaHvbertgor6krtQSYki1sw+Rp8VlemYj1j5SFLumOcbKDhrkT0qhaj0tHvMwv2rYWmWHn7z42c8btG5H7kGpMnbXzkPMeDdRxAulLsp3JOGP0QUntn7EeNxMGjmui3/GE5z9/YkRyTYYLS2d8c/c8KKk5N4WIkcftOeRWP4+gD/PCPL9AdTt7MUki5p/ybdpIWr0dN/chjCcTTSDP6l/WSzevn79t3t8oQChWSpJgC3MB6BfmFtM9+qxW11MhQl1e4Qqe8HBdyLIvfFbqP41y9pOdUaeTnS8BR9lCZvWa82KLjSlmU35H6MIvNDCCAe0GCSqGSIb3DQEHATAUBggqhkiG9w0DBwQIwrvBLIp7EBmAggHI1I2XaTC2KicUoq8IVZbwWHVK14ZTvF1uxp+duhpSOu0K2ohrn/jIYxFbdbd5lHsgNYbm/j599c01Wn4uRdjj3rqkrB9UpUMDqqJ5E1mf7FAwP+yuU6D40ml6b4APj2d6lggkip4Z0hD4ZvV6xnNOueGw2K50PvatADRG8LBe8CHRN4OWi9juKulS+Nn9zw53QANIYDlEc2RWMrAUQOqbMcXxa42TmZAgCWTgMcdkRa7NlBOfOmpStpmu2U8HJUTXEqGkpqf3/J5zvV3QLhbheEGTb5TZMo67eleWt0kfEmH+4fikq9+YlAbRsYucLrfFSYnS1C9RFGD4fYWWmyD3LVVEb0yqRsuGcEcIiB2XUPYVoUbYSTZN3ya0ivxBdoJ3bw2oeSjwaAPOmN3ztyTFYGbvJanB!\r\nFP3YYGnYBN1DTlbJrq8191dWx0jDxkfq5t1+3YpifBBzkMhbQKySPfgKS9AiggFmJByapND+AflEYu3cQFWY7ZzGo1VHP64thOQ97AZp+sKj3cZ1ExGQj2u22V+BSOu0J+ky15O3k2KQb8EY/eQNxKAAg6AiieoRqFARC+ZBju5TGNRVNUf8ukxV14Z07/2LA+TA\", \"publicSettings\": {}, \"protectedSettingsCertThumbprint\": \"E60DAF16AD4BEEDD25881D62ECA159431E8A114B\"}}]}\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Config decoded correctly.\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] set most recent sequence number to 2\r\n2016/08/05 16:43:28 CreateAccount: azureuser already exists. Will update password.\r\n2016/08/05 16:43:28 Change user password\r\n2016/08/05 16:43:28 Created user account: azureuser\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Succeeded in create the account or set the password.\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Succeeded in resetting ssh_key.\r\n2016/08/05 16:43:28 [Microsoft.OSTCExtensions.VMAccessForLinux-1.4.1.0] Enable,success,0,Enable succeeded."},"comment":{"url":"https://api.github.com/repos/Azure/azure-linux-extensions/issues/comments/242538437","html_url":"https://github.com/Azure/azure-linux-extensions/issues/218#issuecomment-242538437","issue_url":"https://api.github.com/repos/Azure/azure-linux-extensions/issues/218","id":242538437,"user":{"login":"boumenot","id":91112,"avatar_url":"https://avatars.githubusercontent.com/u/91112?v=3","gravatar_id":"","url":"https://api.github.com/users/boumenot","html_url":"https://github.com/boumenot","followers_url":"https://api.github.com/users/boumenot/followers","following_url":"https://api.github.com/users/boumenot/following{/other_user}","gists_url":"https://api.github.com/users/boumenot/gists{/gist_id}","starred_url":"https://api.github.com/users/boumenot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boumenot/subscriptions","organizations_url":"https://api.github.com/users/boumenot/orgs","repos_url":"https://api.github.com/users/boumenot/repos","events_url":"https://api.github.com/users/boumenot/events{/privacy}","received_events_url":"https://api.github.com/users/boumenot/received_events","type":"User","site_admin":false},"created_at":"2016-08-25T20:58:35Z","updated_at":"2016-08-25T20:58:35Z","body":"Sorry about the delay, I was on vacation, and I am just returning to this.\r\n\r\n@yuxisun1217 - I dug into this a little bit more I *think* I understand the issue a little bit better.\r\n\r\nIf you pass a configuration with a **password** the VMAccess extension will update SSHD's configuration to ensure passwords are an accepted authentication mechanism.\r\n\r\n```json\r\n{\r\n  \"username\":\"azureuser\",\r\n  \"password\":\"SuperSecret==\"\r\n}\r\n```\r\n\r\nThe code makes the following changes to /etc/ssh/sshd_config.\r\n* set _PasswordAuthentication_ to  \"yes\"\r\n* set _ChallengeResponseAuthentication_ \"yes\"\r\n\r\nThe code fails to create a backup for /etc/ssh/sshd_config, and fails to restart SSHD, which it would need to do to ensure the change actually works for the end-user. I believe this explains why you had to restart SSHD for the change to take effect.  Does this agree with your understanding?\r\n\r\nThe modification to /etc/sudoers.d/waagent is dependent upon the configuration used with VMAccess. \r\n* If configuration contains password, then configuration is set to \"ALL = (ALL) ALL\"\r\n* If configuration does not contain password, then configuration is set to \"ALL = (ALL) NOPASSWD: ALL\"\r\n\r\nThe ability to log into the VM with an empty password leads me to believe you specified a configuration like the following.  If so, this would re-create the behavior your described.\r\n\r\n```json\r\n{\r\n  \"username\":\"azureuser10\",\r\n  \"password\":\"\"\r\n}\r\n```\r\n\r\nThe code allows users to set empty passwords. This is valid, but unintended in your case.\r\n\r\nI think there are at least two fixes that need to be made here.\r\n1. Ensure /etc/ssh/sshd_config is backed up when edits are made.  If the user specifies a password sshd_config is updated, but not backed up.\r\n1. Ensure SSHD is restarted whenever edits are made.  If the user specifies a password sshd_config is updated, but not restarted automatically.\r\n\r\nWhat do you think?\r\n\r\n\r\n"}}
{"actor":{"display_login":"boumenot"}}