Add flag to disable SSHD on the amphora image

Also deprecate the amp_ssh_access_allowed option.

Change-Id: Icb61a65fac57e74235fac904639c411b0fa2b495

diskimage-create/README.rst

@@ -70,6 +70,7 @@ Command syntax:
             [-c **~/.cache/image-create** | <cache directory> ]
             [-h]
             [-i **ubuntu** | fedora | centos | rhel ]
+            [-n]
             [-o **amphora-x64-haproxy** | <filename> ]
             [-r <root password> ]
             [-s **2** | <size in GB> ]
@@ -82,6 +83,7 @@ Command syntax:
         '-c' is the path to the cache directory (default: ~/.cache/image-create)
         '-h' display help message
         '-i' is the base OS (default: ubuntu)
+        '-n' disable sshd (default: enabled)
         '-o' is the output image file name
         '-r' enable the root account in the generated image (default: disabled)
         '-s' is the image size to produce in gigabytes (default: 2)

diskimage-create/diskimage-create.sh

@@ -26,6 +26,7 @@ usage() {
     echo "            [-d **xenial** | trusty | <other release id> ]"
     echo "            [-h]"
     echo "            [-i **ubuntu** | fedora | centos | rhel ]"
+    echo "            [-n]"
     echo "            [-o **amphora-x64-haproxy** | <filename> ]"
     echo "            [-r <root password> ]"
     echo "            [-s **2** | <size in GB> ]"
@@ -39,6 +40,7 @@ usage() {
     echo "        '-d' distribution release id (default on ubuntu: xenial)"
     echo "        '-h' display this help message"
     echo "        '-i' is the base OS (default: ubuntu)"
+    echo "        '-n' disable sshd (default: enabled)"
     echo "        '-o' is the output image file name"
     echo "        '-r' enable the root account in the generated image (default: disabled)"
     echo "        '-s' is the image size to produce in gigabytes (default: 2)"
@@ -74,7 +76,7 @@ if [ -z $OCTAVIA_REPO_PATH ]; then
 fi
 dib_enable_tracing=
 
-while getopts "a:b:c:d:hi:o:t:r:s:vw:x" opt; do
+while getopts "a:b:c:d:hi:no:t:r:s:vw:x" opt; do
     case $opt in
         a)
             AMP_ARCH=$OPTARG
@@ -112,6 +114,9 @@ while getopts "a:b:c:d:hi:o:t:r:s:vw:x" opt; do
                 exit 3
             fi
         ;;
+        n)
+            AMP_DISABLE_SSHD=1
+        ;;
         o)
             AMP_OUTPUTFILENAME=$(readlink -f $OPTARG)
         ;;
@@ -174,6 +179,8 @@ AMP_IMAGETYPE=${AMP_IMAGETYPE:-"qcow2"}
 
 AMP_IMAGESIZE=${AMP_IMAGESIZE:-2}
 
+AMP_DISABLE_SSHD=${AMP_DISABLE_SSHD:-0}
+
 if [ "$AMP_BASEOS" = "rhel" ] && [ "$AMP_IMAGESIZE" -lt 3 ]; then
     echo "RHEL based amphora requires an image size of at least 3GB"
     exit 1
@@ -324,6 +331,11 @@ AMP_element_sequence="$AMP_element_sequence pip-cache"
 # Add certificate ramfs element
 AMP_element_sequence="$AMP_element_sequence certs-ramfs"
 
+# Disable SSHD if requested
+if [ "$AMP_DISABLE_SSHD" ]; then
+    AMP_element_sequence="$AMP_element_sequence remove-sshd"
+fi
+
 # Allow full elements override
 if [ "$DIB_ELEMENTS" ]; then
     AMP_element_sequence="$DIB_ELEMENTS"

elements/remove-sshd/README.rst

@@ -0,0 +1,11 @@
+===========
+remove-sshd
+===========
+This element ensures that openssh server is uninstalled and will not start.
+
+Note
+----
+Most cloud images come with the openssh server service installed and enabled
+during boot. However, sometimes this is not appropriate. In these cases,
+using this element may be helpful to ensure your image will not accessible via
+SSH.

elements/remove-sshd/package-installs.yaml

@@ -0,0 +1,2 @@
+openssh-server:
+    uninstall: True

etc/octavia.conf

@@ -192,8 +192,9 @@
 # amp_image_owner_id =
 # Nova parameters to use when booting amphora
 # amp_flavor_id =
+# Upload the ssh key as the service_auth user described elsewhere in this config.
+# Leaving this variable blank will install no ssh key on the amphora.
 # amp_ssh_key_name =
-# amp_ssh_access_allowed = True
 
 # Networks to attach to the Amphorae examples:
 #  - One primary network

octavia/common/config.py

@@ -297,6 +297,11 @@ controller_worker_opts = [
                help=_('SSH key name used to boot the Amphora')),
     cfg.BoolOpt('amp_ssh_access_allowed',
                 default=True,
+                deprecated_for_removal=True,
+                deprecated_reason='This option and amp_ssh_key_name overlap '
+                                  'in functionality, and only one is needed. '
+                                  'SSH access can be enabled/disabled simply '
+                                  'by setting amp_ssh_key_name, or not.',
                 help=_('Determines whether or not to allow access '
                        'to the Amphorae')),
     cfg.ListOpt('amp_boot_network_list',

octavia/controller/worker/tasks/compute_tasks.py

@@ -63,9 +63,12 @@ class ComputeCreate(BaseComputeTask):
         LOG.debug("Compute create execute for amphora with id %s", amphora_id)
 
         user_data_config_drive = CONF.controller_worker.user_data_config_drive
+
+        key_name = CONF.controller_worker.amp_ssh_key_name
+        # TODO(rm_work): amp_ssh_access_allowed is deprecated in Pike.
+        # Remove the following two lines in the S release.
         ssh_access = CONF.controller_worker.amp_ssh_access_allowed
-        ssh_key = CONF.controller_worker.amp_ssh_key_name
+        key_name = None if not ssh_access else key_name
-        key_name = None if not ssh_access else ssh_key
 
         try:
             if CONF.haproxy_amphora.build_rate_limit != -1:

releasenotes/notes/deprecate-amp_ssh_key_name-e1041a64ed970a9e.yaml

@@ -0,0 +1,17 @@
+---
+features:
+  - |
+    New option in diskimage-create.sh `-n` to completely disable sshd on the
+    amphora.
+deprecations:
+  - |
+    Config option `amp_ssh_access_allowed` is deprecated, as it overlaps with
+    `amp_ssh_key_name` in functionality and is not needed. Simply leave the
+    variable `amp_ssh_key_name` blank and no ssh key will be installed. This
+    is the same result as using `amp_ssh_access_allowed = False`.
+security:
+  - |
+    It is now possible to completely remove sshd from the amphora image, to
+    further lock down access and increase security. If this is set, providing
+    an `amp_ssh_key_name` in config will install the key, but ssh access will
+    not be possible as sshd will not be running.