From fe8edab1f4c761dcd6bad8eb6ccadd62627b077a Mon Sep 17 00:00:00 2001
From: Oliver Walsh <owalsh@redhat.com>
Date: Thu, 4 May 2017 20:21:51 +0100
Subject: Disable SSH login for nova_migration user when migration over ssh is
 disabled.

If migration over ssh is enabled, and then later disabled, the ssh config
for the nova_migration user remains intact. This change clobbers the migration
SSH key to disable login when it is not necessary.

Change-Id: Icc6d5d4f4671b3525a731d334ca6fa7c5419dac3
Closes-Bug: #1688321
---
 manifests/profile/base/nova.pp | 57 +++++++++++++++++++++++++-----------------
 1 file changed, 34 insertions(+), 23 deletions(-)

(limited to 'manifests/profile/base')

diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp
index 65355d4..6065e62 100644
--- a/manifests/profile/base/nova.pp
+++ b/manifests/profile/base/nova.pp
@@ -217,31 +217,42 @@ class tripleo::profile::base::nova (
           notify  => Service['sshd']
         }
 
-        file { '/etc/nova/migration/authorized_keys':
-          content => $migration_ssh_key['public_key'],
-          mode    => '0640',
-          owner   => 'root',
-          group   => 'nova_migration',
-          require => Package['openstack-nova-migration'],
-        }
+        $migration_authorized_keys = $migration_ssh_key['public_key']
+        $migration_identity = $migration_ssh_key['private_key']
+        $migration_user_shell = '/bin/bash'
+      }
+      else {
+        # Remove the keys and prevent login when migration over SSH is not enabled
+        $migration_authorized_keys = '# Migration over SSH disabled by TripleO'
+        $migration_identity = '# Migration over SSH disabled by TripleO'
+        $migration_user_shell = '/sbin/nologin'
+      }
 
-        # Client side
-        file { '/etc/nova/migration/identity':
-          content => $migration_ssh_key['private_key'],
-          mode    => '0600',
-          owner   => 'nova',
-          group   => 'nova',
-          require => Package['openstack-nova-migration'],
-        }
-        $migration_pkg_ensure = installed
-      } else {
-        $migration_pkg_ensure = absent
+      package { 'openstack-nova-migration':
+        ensure => present,
+        tag    => ['openstack', 'nova-package'],
+      }
+
+      file { '/etc/nova/migration/authorized_keys':
+        content => $migration_authorized_keys,
+        mode    => '0640',
+        owner   => 'root',
+        group   => 'nova_migration',
+        require => Package['openstack-nova-migration']
+      }
+
+      file { '/etc/nova/migration/identity':
+        content => $migration_identity,
+        mode    => '0600',
+        owner   => 'nova',
+        group   => 'nova',
+        require => Package['openstack-nova-migration']
+      }
+
+      user {'nova_migration':
+        shell   => $migration_user_shell,
+        require => Package['openstack-nova-migration']
       }
-    } else {
-      $migration_pkg_ensure = absent
-    }
-    package {'openstack-nova-migration':
-      ensure => $migration_pkg_ensure
     }
   }
 }
-- 
cgit 1.2.3-korg