nuageinit: implement ssh_authkey_fingerprints support

Add support for the 'ssh_authkey_fingerprints' cloud-config key
which logs SSH host key fingerprints to the console via ssh-keygen.

libexec/nuageinit/nuageinit

@@ -509,6 +509,29 @@ local function ssh_pwauth(obj)
 	nuage.update_sshd_config("PasswordAuthentication", value)
 end
 
+local function ssh_authkey_fingerprints(obj)
+	if obj.ssh_authkey_fingerprints ~= true then return end
+	local ssh_dir = root .. "/etc/ssh"
+	local attrs = lfs.attributes(ssh_dir)
+	if not attrs or attrs.mode ~= "directory" then
+		return
+	end
+	for entry in lfs.dir(ssh_dir) do
+		if entry:match("^ssh_host_.*_key$") then
+			local keypath = ssh_dir .. "/" .. entry
+			local f = io.popen("ssh-keygen -l -f " ..
+			    nuage.shell_escape(keypath), "r")
+			if f then
+				local fingerprint = f:read("*a")
+				f:close()
+				if fingerprint and fingerprint ~= "" then
+					io.stderr:write(fingerprint)
+				end
+			end
+		end
+	end
+end
+
 local function ssh_deletekeys(obj)
 	if obj.ssh_deletekeys == nil then return end
 	if obj.ssh_deletekeys then
@@ -897,6 +920,7 @@ elseif line == "#cloud-config" then
 		create_default_user,
 		ssh_deletekeys,
 		ssh_keys,
+		ssh_authkey_fingerprints,
 		network_config,
 		resolv_conf,
 		keyboard,

libexec/nuageinit/nuageinit.7

@@ -232,6 +232,11 @@ The keyboard variant (e.g.,
 .Qq acc ,
 .Qq nodeadkeys ) .
 .El
+.It Ic ssh_authkey_fingerprints
+Boolean which determines whether fingerprints of SSH host keys
+should be logged to the console.
+Defaults to
+.Ar false .
 .It Ic timezone
 Sets the system timezone based on the value provided.
 .Pp

libexec/nuageinit/tests/nuageinit.sh

@@ -37,6 +37,7 @@ atf_test_case config2_userdata_manage_etc_hosts
 atf_test_case config2_userdata_mounts
 atf_test_case config2_userdata_resolv_conf
 atf_test_case config2_userdata_keyboard
+atf_test_case config2_userdata_ssh_authkey_fingerprints
 atf_test_case config2_userdata_fqdn_and_hostname
 atf_test_case config2_userdata_write_files
 
@@ -1198,6 +1199,25 @@ EOF
 	true
 }
 
+config2_userdata_ssh_authkey_fingerprints_head()
+{
+	atf_set "require.user" root
+}
+config2_userdata_ssh_authkey_fingerprints_body()
+{
+	mkdir -p media/nuageinit
+	setup_test_adduser
+	printf "{}" > media/nuageinit/meta_data.json
+	mkdir -p etc/ssh
+	ssh-keygen -t ed25519 -f etc/ssh/ssh_host_ed25519_key -N "" -q 2>/dev/null
+	cat > media/nuageinit/user_data <<EOF
+#cloud-config
+ssh_authkey_fingerprints: true
+EOF
+	atf_check -s exit:0 -e match:"SHA256:" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
+	true
+}
+
 config2_userdata_fqdn_and_hostname_body()
 {
 	mkdir -p media/nuageinit
@@ -1250,6 +1270,7 @@ atf_init_test_cases()
 	atf_add_test_case config2_userdata_mounts
 	atf_add_test_case config2_userdata_resolv_conf
 	atf_add_test_case config2_userdata_keyboard
+	atf_add_test_case config2_userdata_ssh_authkey_fingerprints
 	atf_add_test_case config2_userdata_fqdn_and_hostname
 	atf_add_test_case config2_userdata_write_files
 }