Jira (PUP-3840) purge_ssh_keys doesn't purge keys when multiple keys with same comment are in authorized_keys file

[Russell Howe (JIRA)]

Title: Message Title

Russell Howe commented on PUP-3840   Re: purge_ssh_keys doesn't purge keys when multiple keys with same comment are in authorized_keys file I have also observed the same warning in Puppet's output. It looks like this happens if you have keys with spaces in their comments. The warning is not always given when there are problems, so puppet may silently be preserving SSH keys on your hosts which you would expect to be removed. Here's a script to exercise this bug (tested on puppet 3.6 - don't ask!) #!/bin/bash   set -ux   U=alice H=/home/$U A_KEYS=$H/.ssh/authorized_keys   userdel -r "$U" || :   # Keys with comments containing spaces where the last word is the same puppet apply --execute " ssh_authorized_key { ['test key', 'another test key']: user => '$U', key => 'x', type => 'ssh-rsa' } user { '${U}': ensure => present, home => '${H}', managehome => true }" echo "Should contain: 'test key' and 'another test key'" cat "$A_KEYS" puppet apply --execute " ssh_authorized_key { ['test key2', 'another test key2']: user => '${U}', key => 'x', type => 'ssh-rsa' } user { '${U}': ensure => present, home => '${H}', purge_ssh_keys => true }" echo "Should contain: 'test key2' and 'another test key2'" cat "$A_KEYS" puppet apply --execute " ssh_authorized_key { ['test key2', 'another test key2']: user => '${U}', key => 'x', type => 'ssh-rsa' } user { '${U}': ensure => present, home => '${H}', purge_ssh_keys => true }" echo "Should contain: 'test key2' and 'another test key2'" cat "$A_KEYS" rm -f "$A_KEYS"   # A mixture of keys with comments containing spaces where the last word is the same and single-word comments which match the last word in multi-word comments puppet apply --execute " ssh_authorized_key { ['test key', 'test key2']: user => '${U}', key => 'x', type => 'ssh-rsa' }" echo "Should contain: 'test key' and 'test key2'" cat "$A_KEYS" puppet apply --execute " ssh_authorized_key { ['test key3', 'test key4']: user => '${U}', key => 'x', type => 'ssh-rsa' } user { '${U}': ensure => present, home => '${H}', purge_ssh_keys => true }" echo "Should contain: 'test key3' and 'test key4'" cat "$A_KEYS" puppet apply --execute " ssh_authorized_key { ['key3', 'key4']: user => '${U}', key => 'x', type => 'ssh-rsa' } user { '${U}': ensure => present, home => '${H}', purge_ssh_keys => true }" echo "Should contain: 'test key3' and 'test key4'" cat "$A_KEYS" rm -f "$A_KEYS"   # Keys with comments not containing whitespace puppet apply --execute " ssh_authorized_key { ['key', 'key2']: user => '${U}', key => 'x', type => 'ssh-rsa' }" echo "Should contain: 'key' and 'key2'" cat "$A_KEYS" puppet apply --execute " ssh_authorized_key { ['key3', 'key4']: user => '${U}', key => 'x', type => 'ssh-rsa' } user { '${U}': ensure => present, home => '${H}', purge_ssh_keys => true }" echo "Should contain: 'key3' and 'key4'" cat "$A_KEYS" puppet apply --execute " ssh_authorized_key { ['key3', 'key4']: user => '${U}', key => 'x', type => 'ssh-rsa' } user { '${U}': ensure => present, home => '${H}', purge_ssh_keys => true }" echo "Should contain: 'key3' and 'key4'" cat "$A_KEYS" Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.