Jira (PUP-3357) Unexpected error with multiple SSH keys without comments

[Gert van Dijk (JIRA)]

Title: Message Title

Gert van Dijk created an issue   Puppet / PUP-3357 Unexpected error with multiple SSH keys without comments Issue Type: Bug Affects Versions: 3.7.0 Assignee: Kylo Ginsberg Components: Types and Providers Created: 28/Sep/14 4:27 AM Environment: Puppet 3.7.0+, Ubuntu 14.04 / Debian 7 Labels: ssh_authorized_key Priority: Normal Reporter: Gert van Dijk Steps to reproduce: 1. Enter multple SSH authorized keys for a user without comments (just a key line by line, see example below). 1. Manage the user with Puppet with the purge_ssh_keys parameter set to true. 1. Have Puppet agent 3.7.0+ 1. Puppet agent run fails completely with an error. (full denial of service of the agent effectively) Note: Because of an unprivileged user being able to block Puppet agent runs I consider this more than just a corner case. More details: Since 3.7.0 (not with 3.6.2), I'm getting an unexpected error on the Puppet agent runs managing the user's SSH authorized keys with purge_ssh_keys enabled. Some users enter multiple keys without comments in the files, e.g.: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBI/HHDwh6ccmX4BT5rpCEt7Z647v3WwmVCamWfxgUMCegYJliI7BjfAMX0HPdlaCfPd67oWQJaKg9qSNEuHBbKM= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYUv24oLUvh8Vr3g0XxocU2AYkc3RTunnrR8ChkWgjru9d3o5O1mdg7dzkQDyiQflHa3XGSbvly9LAxKOQhJtZEHJ6+Sn8iAo5edJR2yE6uX2O9DcYOgaoZO0Rg3PG5JsP3JdrS5lb3jwvsGfPFU+bC5egEypWDnIakLQksvkcldwMuzDVeExm11LakMd2MPig4gaje7HVoP++LVLxqxYUZQTiEGOZwTnysO/CywhGvD5V2n59T+1Hqhz9cgx+l2fdJxuJPXq9a7V+crxxLW22w/LIj70KvdDPh7jyfAzMk+k8tYg/6FbTz6sft2uQ043fCBso8iy2iTIAj8xqBKab This results in the following error in 3.7.0+: Error: Could not apply complete catalog: Duplicate declaration: Ssh_authorized_key[] is already declared; cannot redeclare With the agent downgraded to 3.6.2, it runs, but it does not remove the existing keys properly. Notice: /Stage[main]/Localusers/Ssh_authorized_key[key0]/ensure: current_value absent, should be present (noop) Notice: /Stage[main]/Localusers/Ssh_authorized_key[key1]/ensure: current_value absent, should be present (noop) Notice: /Stage[main]/Localusers/Ssh_authorized_key[key2]/ensure: current_value absent, should be present (noop) Add Comment   This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.